CVE-2023-22771: Insufficient Session Expiration in ArubaOS Command Line Interface
Published Feb 28, 2023
·Updated
An insufficient session expiration vulnerability exists in the ArubaOS command line interface. Successful exploitation of this vulnerability allows an attacker to keep a session running on an affected device after the removal of the impacted account
Affected Software
26 affected components
Arubanetworks Arubaos>=8.6.0.0<=8.6.0.19
Arubanetworks Arubaos>=8.10.0.0<=8.10.0.4
Arubanetworks Arubaos>=10.3.0.0<=10.3.1.0
Arubanetworks 7010
Arubanetworks 7030
Arubanetworks 7205
Arubanetworks 7210
Arubanetworks 7220
Arubanetworks 7240xm
Arubanetworks 7280
Arubanetworks 9004
Arubanetworks 9004-lte
Arubanetworks 9012
Arubanetworks Mc-va-10
Arubanetworks Mc-va-1k
Arubanetworks Mc-va-250
Arubanetworks Mc-va-50
Arubanetworks Mcr-hw-10k
Arubanetworks Mcr-hw-1k
Arubanetworks Mcr-hw-5k
Arubanetworks Mcr-va-10k
Arubanetworks Mcr-va-1k
Arubanetworks Mcr-va-50
Arubanetworks Mcr-va-500
Arubanetworks Mcr-va-5k
Arubanetworks Sd-wan>=8.7.0.0-2.3.0.0<=8.7.0.0-2.3.0.8
Event History
Feb 28, 2023
CVE Published
via MITRE·04:53 PM
Data Sourced
via MITRE·04:53 PM
DescriptionSeverity
Frequently Asked Questions
1
What is the vulnerability ID of this vulnerability?
The vulnerability ID is CVE-2023-22771.
2
What is the severity of CVE-2023-22771?
The severity of CVE-2023-22771 is medium.
3
How does CVE-2023-22771 impact ArubaOS?
CVE-2023-22771 allows an attacker to keep a session running on an affected device after the removal of the impacted account.
4
Which versions of ArubaOS are affected by CVE-2023-22771?
ArubaOS versions ranging from 8.6.0.0 to 8.6.0.19, 8.10.0.0 to 8.10.0.4, and 10.3.0.0 to 10.3.1.0 are affected by CVE-2023-22771.
5
How can I fix CVE-2023-22771?
There is currently no known fix for CVE-2023-22771. It is recommended to apply the necessary patches or updates provided by the vendor.